Information Management Assessment

Action plan progress review

Department for Work and Pensions

Reviewed October 2016

Published February 2017

Working with government to raise standards in information management Background

The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management.

The Department for Work and Pensions (DWP) IMA took place in 2015. We conducted interviews at the department’s London, Leeds and Manchester offices, including a Job Centre and a Benefits Delivery Centre between 2 and 12 March 2015. DWP produced a detailed action plan and we formally assessed progress against this in October 2016. The IMA report and action plan are both published on The National Archives website.¹

This progress review summarises key developments since the IMA. Areas where continued attention is still needed are listed below under ‘Next Steps.’

¹ http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/ Progress to address recommendations and risk areas

1 The value of information

| Performance rating | IMA 2015 | Review 2016 | |--------------------|----------------|-------------| | Communicating and realising value | Development area | Satisfactory | | Managing information as an asset | Good | Good |

Situation at the time of the IMA

DWP recognised the importance and value of its information and particularly the importance of protecting sensitive information. It had made excellent progress in the area of information exploitation and in establishing a process for information asset management and there had been some positive support from senior management.

DWP had an information strategy (2012) in place which it assured us was being updated, but it did not have a central set of goals around corporate records management which fitted within the wider strategic picture.

Although staff recognised the importance of record keeping, they were still not consistently complying with the print to paper policy. It was recommended that DWP appoint a senior champion for records management to raise awareness of the importance of records management and help promote the message that all staff have an important role in ensuring that the right records are kept and managed appropriately.

We are pleased to see that DWP has developed a high level Corporate Records Management Strategy which was signed off by Information Management Assurance Board in July 2015. This links in with the wider DWP Information Strategy and critical success factors are defined (see below), as are a list of activities including staff and project engagement, training, guidance and work on the existing shared drives. This is good practice.

- **Increased personal accountability for the management of corporate information.** Staff are information owners on behalf of the Department and have an obligation to manage information in a way which meets its legal obligations and business needs. They will be helped in the discharge of these obligations by trained individuals embedded in the business.

- **Information is only stored for as long as there is a business need to retain it.** An estimated 400 million separate information items are stored digitally. Only the information which needs to be held for business purposes should be migrated to and stored on the EDRMS. That will also reduce the future costs of digital storage.

- **Increased assurance over compliance with the Public Records Act.** At the point when the EDRMS is implemented, assurance will be needed that all “significant” information created up to that date has been filed. Options for scanning such information held in paper form into the EDRMS will be considered in due course.

- **Clarity over what information is held and where at the point of migration.** This will provide a platform for migrating corporate information into the EDRMS and storing it there in a structured and accessible forum.

DWP should ensure that this strategy provides direction as it finds a solution for managing its corporate digital information and update as required.

DWP has not yet officially engaged a senior champion for records management, though in practice the Director General of Digital is already operating in this space. In order to have maximum impact, DWP have indicated that they hope to launch this role when progress on the EDRMS is more mature and closer to delivery. DWP should ensure that this happens and use this role to promote the Corporate Records Management Strategy.

The role of the BSIROS has been retitled as ‘Deputy SIRO’ and strengthened ‘in line with current challenges and business priorities.’ DWP reported that a series of workshops have been delivered to Information Asset Managers and Information Asset Coordinators by the Security Assurance team. The content was based on the The National Archives’ learning pack developed for Information Asset Owners, with a DWP slant, focussing on identifying, recording and managing information assets. This covered use of the inventory, identification and management of risks and retention and destruction.

The Information Asset Coordinator workshops are about up-skilling and knowledge sharing across the community. They cover what is happening in the information assurance and information management space including the Information Asset Inventory and records management as well as a broader view of what is happening round Security. Recent sessions have picked up on the wider education and awareness campaign and security policy development.

In addition DWP stated that they are delivering similar events for the Deputy SIRO community covering the broad range of issues and topics that they need to be engaged on. The last face to face event covered information assurance, General Data Protection Regulations, supplier assurance, information and security risk management. This is good practice.

2 Digital information and supporting technology

| Performance rating | IMA 2015 | Review 2016 | |------------------------------------|-------------------|-------------------| | Supporting information through technology | Development area | Development area | | Digital continuity and IT change | Development area | Development area | Situation at the time of the IMA

DWP did not have a system for electronic records management and a print to paper policy was still in operation. Shared drives were widely used but there is no central Knowledge and Information Management (KIM) team oversight or control of these. Shared drives are not routinely well managed locally and they do not fully support the management of information throughout its lifecycle.

DWP had a partial view of its corporate digital information and requirements for records management had not always been part of projects to introduce new technology. The limitations of the shared drive environment, inconsistent adoption of the print to paper policy, and a lack of oversight and control of corporate digital information, meant there was a very real risk that the organisation would not have the information it needed to carry out its business and might not be able to comply with information legislation and information assurance obligations.

Although DWP does not yet have a system in place for managing its digital corporate information, considerable work has been undertaken on Office 365 over the past 12 months which DWP have indicated will deliver significant document management improvements, including records management functionality outside of a planned electronic storage site. There is also senior level agreement and funding to deliver EDRMS in the next financial year.

In the March 2016 progress update to The National Archives, DWP set out plans to conduct a private beta testing of the suitability of Alfresco to deliver the DWP electronic records management solution. However, this work was suspended following a strategic review of technology projects across DWP in spring 2015 in order to explore alternative EDRMS options which were felt may provide a better fit with the Department’s strategic direction.

DWP are now exploring two possible options: • Using SharePoint as the end to end solution for document and records management. DWP is delivering Microsoft Office 365 including SharePoint Online as the Departments document management platform during 2017.

• Configuration of existing technology within DWP (File Net – already used for the DRS) to provide the records storage solution, with documents exported into it from SharePoint.

Business cases are being developed to run proof of concepts for each proposed solution. As part of this process, requirements for information and records management have been scoped by the project team, whilst user engagement and training are a key part of the project delivery roadmaps. The requirements cover disposal, audit, version control, administration and records.

A final decision on which EDRMS option is to be implemented is planned to take place in mid-2017, with roll out likely to take 18-24 months. According to DWP, the delay ‘reflects the scale of competing priorities as it seeks to deliver a significant transformational programme of work.’

DWP needs to ensure that whatever solution is chosen meets the requirements they have identified for information and records management and that the KIM team are fully involved in the decision making process. As with the on premise version of SharePoint, SharePoint Online alone will not fulfil all requirements around records management and email connectivity is a particular problem. Many government departments use third party plug-ins to boost the records management functionality of the on premise version of SharePoint. Government departments such as Defra and Department for Transport are currently exploring how these plug-ins will work with SharePoint Online. DWP should keep in touch with The National Archives and other government departments on this work and with wider government developments around Office 365. As recommended in our 2015 IMA report, DWP has linked up with other government departments to learn from their experiences. This included discussions with BIS on Alfresco (now BEIS) and sharing of lessons learnt and the products BIS have developed. DWP also joined and participated in the Alfresco meet up for Government sessions. DWP has also had discussions on SharePoint/SharePoint Online with Department for Education, Defra, Home Office and Welsh Assembly.

The print to paper policy is no longer mandatory and staff have been given the flexibility to save their records on the shared drives. Staff can still choose to print to paper if they wish and guidance stipulates that they should continue with paper files where they already exist to try to avoid having hybrid files. By approving the use of shared drives for record keeping DWP hope to ‘drive increased compliance with records management policies and additionally to condition business areas to how electronic records management looks and feels, enabling a smooth transition to the chosen EDRMS solution.’ Take up of this new policy is patchy so far with some keen to adopt and other less so. Although it is positive that DWP have now sanctioned digital record keeping, allowing staff to continue to create paper files will mean that there isn’t a clean cut off point in terms of establishing whether the official record resides in a paper or digital format. DWP should end the use of paper registered files once the new EDRM system has been implemented.

DWP recognise that they need technical tools to realise their plan for identification of material of value on the shared drives and migration of content to a new EDRM system and are working to overcome this barrier. The shared drives are increasing in size by about 4Tb each month. An initial workshop was held with stakeholders out in the business on how best to approach this activity. The Knowledge and Information Management Division (KIMD) are collaboratively working with Technology colleagues to establish what tools are available to help identify information. DWP Technology has commissioned a number of scans and IT enablers to survey the information held in shared areas. DWP were hopeful that these products would be activated in early 2017 and should help to inform next steps including migration and data cleanse activity and whether a further e-discovery tool is needed. DWP are also engaging with the Cross Government Records Management Project on this to assess the viability of running a pilot of Data Storm.

Retention periods have been applied to Lync (system for instant messaging) and discussions have taken place with Collaboration Services to agree a retention policy for the new iteration of the intranet which will be built on an Invotra platform. Further discussion is required for the existing archive of guidance in the Web Content Management System.

An improved Business Impact Analysis of key systems is currently being carried out to drive improvements to disaster recovery arrangements. A new DWP-wide Continuity and Resilience policy will be launched in the first quarter of 2017/18 and we expect this to further strengthen DWP’s approach to digital continuity.

Universal Credit Digital Service will replace a number of legacy systems as the transition for the affected benefits takes place. Decommissioning of the existing systems will only take place once all that activity has occurred. The current focus is to ensure that the systems stand up and there are robust recovery plans for each one. For example, each system is backed up every night so in the event of total failure a previous version would be uploaded minimising any data loss. The back-ups are also duplicated across 2 servers so if one server crashes the other is still available. If a case corrupts it is either maintained clerically or deleted off the main frame and rebuilt.

### 3 Information risk, governance and oversight

| Performance rating | IMA 2015 | Review 2016 | |-----------------------------|-------------------|----------------------------------| | Recognising information risk| Development area | Progressing towards satisfactory | | Establishing control | Satisfactory | Satisfactory | | Providing guidance | Good | Good | Situation at the time of the IMA

DWP had a solid process in place for managing risk. Information risk was recognised and managed, at least in terms of the security and protection of sensitive information. However, risks around the wider management of information and records were not yet fully recognised within the department’s risk management framework. DWP needed to ensure that it defined the risk of failing to manage its corporate information so that the impact of not capturing or keeping the information that is needed can be understood at all levels of the business and managed. The SIRO should have sight of this risk and the actions that are in place to manage it.

DWP had a comprehensive set of KIM policies and guidance covering the whole of the information lifecycle and there had been good efforts to promote this across the organisation.

There were relatively few formal measures in place to measure compliance with the Records Management Policy and it was recommended that paper records audits should be extended to cover digital records. A question on records management had been included in the Information Assurance Asset Returns and business areas were expected to provide evidence to demonstrate how they were meeting this. This approach was still maturing and the KIM team needed to define exactly what it wanted business areas to report on.

DWP reported that the new Enterprise Security and Risk Management Strategy has been signed off by the CSO and SIRO. DWP reported that around 200 projects are being assisted through the risk process and it is now producing a supporting toolkit to help implement this strategy. Terms of reference for the Departmental Security Oversight Board (DSOB) were updated in February 2016. DSOB is the ‘strategic decision-making body and escalation route for significant information management, security issues and cross-cutting risks.’ Information management is clearly reflected in the responsibilities within the updated terms of reference, for example:

- Supporting the development of a proactive information security culture, effective information management and assurance networks, and organisational maturity in DWP

- Oversee and ensure assurance on the effectiveness of security and information management within the department: escalating strategic departmental and/or aggregated risks to the DWP executive team when required

- Overseeing the delivery of cultural change in the Department through organisational and capability improvements, which will set and maintain the pace of change for information management and security to ensure attainment of business delivery objectives and to support digital transformation

DWP reported that information risks are now regularly covered during DSOB meetings. DSOB minutes provided as evidence for this review showed that there had been several discussions and decisions around the personally sensitive information held on shared drives and the management of this. Risk assessment workshops have been commissioned by DSOB on the issue of personal data in shared folders and mitigating activity commissioned in response including:

- A review of the policies that are in place to drive compliance with storing personal data in shared folders. • Launch of an acceptable usage policy in September to make it clear that no personal data should be stored in shared folders without security accreditation.

• Business engagement to understand instances of non-compliance and how enforcement can be achieved including training and guidance refreshers, better communications from leaders stressing the priority of this issue and future monitoring activity.

• A pilot review of a selection of Operations folders, to fully identify all personal data in shared folders and help develop tools to provide critical business capability.

DSOB and the SRA have recently commissioned risk assessments on unstructured data - resulting in a red risk with a remediation plan being developed.

As described in section 1, DWP have also delivered a series of workshops to IAM and IACS lead by the Security Assurance team to help improve understanding and drive good practice. In addition DWP is developing a Governance Risk and Compliance tool which will link information assets with risk assessments, enable the identification of threats and vulnerabilities and provide an enhanced capability to track policy compliance. This will be rolled out in early 2017.

This work demonstrates a strengthening of DWPs approach to risk management and recognition of information risks. DWP still needs to ensure that risks relating to information and records management are recognised in practice and define the risk of failing to manage its corporate information so that the impact of not capturing or keeping the information that is needed can be understood at all levels of the business and managed.

DWP has not yet established a network of KIM Champions and information reps to support information and records management. DWP state that this work has been held up due to the delay around implementing an EDRMS. It is still intended that KIM champions will be identified in business units to support the roll-out of the EDRMS and Office 365. Whilst positive that DWP intend to use these roles to support the rollout of new digital systems, responsibilities also need to cover the wider championing of good records management, why this matters and monitoring behaviours. DWP also needs to ensure that it influences staff behaviours around records and information management and mitigates risks in the interim.

We are pleased to note that the Essential Records Management campaign of bite-sized information on IM and RM is now available on the intranet and has been advertised through the bi-monthly newsletter, ‘Just for the Record.’ This is good practice. DWP are also looking to update their intranet site and are doing a survey of users to see what they need. There are also plans to update the desk guides.

To support the introduction of e-registered files, the records management policy was updated to reflect the new approach. The KIM team offered guidance to staff and promoted the policy within targeted business areas. It is also covered in all stakeholder engagement presentations. A headline news article appeared on the intranet about this and there was an article in the ‘Just For the Record’ newsletter. DWP should continue to promote the new policy and ensure that all staff are made aware of this change through communications, guidance and training.

Future training for staff in how to use a new system for managing information and records is a key strand of the project to implement an EDRMS. DWP is also talking to other government departments about training strategies when introducing EDRMS, to follow best practice and follow the lessons learned.

DWP has been working to better monitor compliance with information and records management policies. A survey targeted at the IAC and IAM Community was carried out with the aim of finding out how they were applying records management policies. This showed a number of gaps that the KIMD team are working to address. The KIMD team have been working with Private Office to tidy up their registries and sort out their files. In addition DWP has now included a retention question on the Departmental Information Asset Inventory, which contains thousands of significant information assets and challenge any entries where retention is not included or does not match current policy. DWP has also revised their approach to annual file registry audits, putting more emphasis on digital material and personal data instead of focussing only on paper files, for example, it will include E-Registered Files. The first audit is due to begin soon.

4 Records, review and transfer

| Performance rating | IMA2015 | Review 2016 | |-------------------------------------|-----------|-------------| | Oversight of records and selection | Satisfactory | Satisfactory | | Implementing disposal decisions | Satisfactory | Satisfactory |

Situation at the time of the IMA

DWP has a robust and well established process in place for the oversight, control and management of its paper records. There was regular, controlled disposal of paper files.

In order to comply with its obligations under the Public Records Act DWP also had very good processes for the appraisal, selection, sensitivity review, preparation and transfer of its paper records, was ahead in the transition to the 20-year rule and did not have a backlog.

Improvements were needed in the management of DWP’s corporate digital information. The KIM team did not have any control of the shared drives and had not yet started to consider how it might appraise, select, sensitivity review and transfer corporate digital information. DWP needed to do more to ensure that shared drives were being managed appropriately. In particular that information of value is being identified and kept for as long as it is needed, and that information is disposed of once it is no longer required.

DWP is currently ahead in the transition to the 20-year rule, has no legacy and at the time of this review was already engaging with The National Archives about 2017 transfers.

DWP has started to plan how it will identify digital records of value and KIMD are working with technology colleagues to identify and procure tools to help interrogate the shared drives (see section 2).

The contract to manage paper stores at Heywood is to move from Capita to Iron Mountain in January 2017. In addition the paper records store at Darlington will be closing and a further 47 shipping containers of paper records will be moved here to Heywood. DWP is carefully managing this process. DWP are also running a project to ensure that customer files due for disposal are destroyed appropriately. Next Steps

The National Archives will continue to work closely with DWP so that the department is supported as it continues its work on information and records management. Outstanding recommendations will be reviewed at the time of the department’s IMA reassessment. It is recommended that DWP focusses on the following:

- Ensure that the Corporate Records Management Strategy is reviewed and updated as necessary.
- Officially launch the role of the Senior Champion and use this role to promote the Corporate Records Management Strategy and help drive achievement of strategy goals.
- Continue work to implement an EDRM solution that meets DWP requirements and enables full lifecycle management of digital records including email.
- Keep up to date with developments and lessons learned across government on implementation of Office 365/SharePoint Online and use of 3rd party plug-ins.
- End the use of paper registered files once the new EDRM system has been implemented.
- Continue to promote the new policy around print to paper/digital records management and ensure that all staff are made aware of this change through communications, guidance and training.
- Further progress work to identify material of value on the shared drives and migration of content to a new EDRM system.
- Ensure that there is a process for appraisal, selection, sensitivity review and transfer for any new EDRM system.
- Ensure that information and records management related risks are recognised in practice and define the risk of failing to manage its corporate information so that the impact of not capturing or keeping the information that is needed can be understood at all levels of the business and managed.
- Establish a network of KIM Champions and ensure that responsibilities cover the wider championing of good records management, why this matters and monitoring behaviours. • Further develop methods of monitoring compliance with information and records management policy.